Organize AI remediation around the frameworks you already use.

Each FlashTower rule is mapped to related controls in widely used frameworks, so security, compliance, and legal teams can connect AI findings to the programs they already run. Mappings are topical references to help organize work — not a determination of compliance.

Run Free AI Security Scan See pricing

Mapped to, not certified

A FlashTower report shows which framework controls each finding relates to. It does not certify, attest, or audit, and it does not establish that you are or are not compliant with any law or standard. Your auditors, assessors, and counsel make those determinations.

Frameworks covered

NIST AI Risk Management Framework, NIST Cybersecurity Framework 2.0, HIPAA Security Rule (45 CFR Part 164 Subpart C), AICPA Trust Services Criteria (SOC 2), ISO/IEC 27001:2022 Annex A, and the OWASP Top 10 for LLM Applications (2025).

Frameworks

Which frameworks FlashTower maps to.

NIST AI Risk Management Framework

National Institute of Standards and Technology · 1.0 (AI 100-1)

Referenced by 24 rules.

NIST Cybersecurity Framework

National Institute of Standards and Technology · 2.0

Referenced by 39 rules.

HIPAA Security Rule (45 CFR Part 164, Subpart C)

U.S. Department of Health and Human Services · 45 CFR 164.302–318

Referenced by 8 rules.

AICPA Trust Services Criteria (SOC 2)

AICPA · 2017 (rev. 2022)

Referenced by 26 rules.

ISO/IEC 27001:2022 Annex A

ISO/IEC · 2022

Referenced by 47 rules.

OWASP Top 10 for LLM Applications

OWASP Foundation · 2025

Referenced by 19 rules.

Framework references indicate that a finding is topically mapped to a control or category in the referenced framework. They are provided to help organize remediation work. A FlashTower assessment is not an audit, certification, attestation, or legal opinion, and does not establish that an organization is or is not compliant with any law, regulation, or standard.

See what your AI can access.

Run the free FlashTower Scan. Get your AI risk score and every finding in about 10 minutes — no account or system access required.